Method and system for accessing private network

Abstract

The present invention discloses a method and system for accessing a private network. The method includes: obtaining a domain name resolution request from a client, wherein the client is an access end of the private network to be accessed; determining whether the domain name resolution request conforms to the domain name format of the private network; allocating a virtual address corresponding to the domain name format to the private network; in response to a resource access request from the client, resolving a target domain name of the private network from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent the target address of the private network; and accessing network resources in the private network based on the original domain name of the private network corresponding to the target domain name, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network. The present invention solves the technical problem of low network access efficiency.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing, and in particular to a method and system for accessing a private network. Background Art

[0002] Currently, the problem of client access to private networks is usually solved by connecting the client and server networks at three layers to enable the client to access the private network.

[0003] However, in the process of opening up the three-layer network, new routing rules need to be added. The new routing rules will cause conflicts with the network segments of the existing network, thereby changing the client's network infrastructure environment. In addition, the number of private networks that can be connected by this method is limited. Since the number of private networks will increase with the increase of clients, this method has the technical problem of low efficiency in opening up the network.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiment of the present invention provides a method and system for accessing a private network, so as to at least solve the technical problem of low efficiency in establishing a network.

[0006] According to one aspect of an embodiment of the present invention, a method for accessing a private network is provided. The method may include: obtaining a domain name resolution request from a client, wherein the client is an access end of the private network to be accessed; determining that the domain name resolution request conforms to a domain name format of the private network; allocating a virtual address corresponding to the domain name format to the private network; in response to a resource access request from the client, resolving a target domain name of the private network from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent a target address of the private network; and accessing network resources in the private network based on an original domain name of the private network corresponding to the target domain name, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent an original address of the private network.

[0007] According to another aspect of an embodiment of the present invention, another method for accessing a private network is provided. The method may include: obtaining an original domain name of the private network, wherein the original domain name is used to represent the original address of the private network; encoding the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; and sending the target domain name to a client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0008] According to another aspect of an embodiment of the present invention, another method for accessing a private network is provided. The method may include: obtaining the original domain name of the private network by calling a first interface, wherein the first interface includes a first parameter, the parameter value of the first parameter is the original domain name, and the original domain name is used to represent the original address of the private network; encoding the original domain name according to the domain name format of the private network to obtain the target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; sending the target domain name to the client by calling a second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the second interface includes a second parameter, the parameter value of the second parameter is the target domain name, the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0009] According to another aspect of an embodiment of the present invention, a system for accessing a private network is provided. The system may include: a client, configured to send a domain name resolution request to a network proxy container, wherein the client is an access end of a gateway to be accessed; the network proxy container, configured to determine whether the domain name resolution request conforms to a domain name format of the gateway and assign a virtual address corresponding to the domain name format to the gateway; in response to a resource access request from the client, resolving a target domain name of the gateway from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent a target address of the private network; accessing network resources in the gateway based on an original domain name of the gateway corresponding to the target domain name, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent an original address of the private network; and the gateway, configured to return network resources to the network proxy container.

[0010] According to another aspect of an embodiment of the present invention, a device for accessing a private network is also provided. The device may include: a first acquisition unit, configured to acquire a domain name resolution request from a client, wherein the client is an access end of the private network to be accessed; a determination unit, configured to determine whether the domain name resolution request conforms to the domain name format of the private network; an allocation unit, configured to allocate a virtual address corresponding to the domain name format to the private network; a resolution unit, configured to resolve a target domain name of the private network from the virtual address in response to a resource access request from the client, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent the target address of the private network; and an access unit, configured to access network resources in the private network based on the original domain name of the private network corresponding to the target domain name, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network.

[0011] According to another aspect of an embodiment of the present invention, another device for accessing a private network is provided. The device may include: a second acquisition unit, configured to acquire an original domain name of the private network, wherein the original domain name is used to represent the original address of the private network; a first processing unit, configured to encode the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; a first sending unit, configured to send the target domain name to a client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0012] According to another aspect of an embodiment of the present invention, another device for accessing a private network is provided. The device may include: a third acquisition unit, configured to acquire the original domain name of the private network by calling a first interface, wherein the first interface includes a first parameter, the parameter value of the first parameter is the original domain name, and the original domain name is used to represent the original address of the private network; a second processing unit, configured to encode the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; a second sending unit, configured to send the target domain name to a client by calling a second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the second interface includes a second parameter, the parameter value of the second parameter is the target domain name, the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0013] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute any of the above-mentioned methods for accessing a private network.

[0014] According to another aspect of an embodiment of the present invention, a processor is provided. The processor is configured to run a program, wherein any one of the above-mentioned methods for accessing a private network is executed when the program is running.

[0015] In an embodiment of the present invention, a domain name resolution request is obtained from a client, wherein the client is an access end of a private network to be accessed; the domain name resolution request is determined to conform to the domain name format of the private network; a virtual address corresponding to the domain name format is allocated to the private network; in response to a resource access request from the client, a target domain name of the private network is resolved from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent the target address of the private network; based on the original domain name of the private network corresponding to the target domain name, network resources in the private network are accessed, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network. In other words, the embodiment of the present invention determines the domain name format that conforms to the private network based on the domain name resolution request of the client, determines the virtual address that corresponds to the domain name format based on the domain name format of the private network, obtains the resource access request that conforms to the domain name format issued by the client, resolves the target domain name of the private network from the virtual address based on the resource access request, and accesses the network resources in the private network based on the original domain name of the private network corresponding to the target domain name, thereby achieving the technical effect of improving the efficiency of network connection and solving the technical problem of low network connection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a structural block diagram of a computing environment according to an embodiment of the present invention;

[0018] Figure 2 is a flow chart of a method for accessing a private network according to an embodiment of the present invention;

[0019] Figure 3 is a flow chart of another method for accessing a private network according to an embodiment of the present invention;

[0020] Figure 4is a flow chart of another method for accessing a private network according to an embodiment of the present invention;

[0021] Figure 5 is a schematic diagram of a computer device accessing a private network according to an embodiment of the present invention;

[0022] Figure 6 is a schematic diagram of a private network access system according to an embodiment of the present invention;

[0023] Figure 7 It is a schematic diagram of the port mapping process according to the related art;

[0024] Figure 8 This is a schematic diagram of connecting a private network system according to an embodiment of the present invention;

[0025] FIG9( a ) is a flow chart of a method for connecting to a private network according to an embodiment of the present invention;

[0026] FIG9( b ) is a schematic diagram of parsing an original network service according to an embodiment of the present invention;

[0027] Figure 10 This is a structural block diagram of a service grid according to a method for processing access to a private network according to an embodiment of the present invention;

[0028] Figure 11 is a schematic diagram of a device for accessing a private network according to an embodiment of the present invention;

[0029] Figure 12 is a schematic diagram of another private network access device according to an embodiment of the present invention;

[0030] Figure 13 is a schematic diagram of another private network access device according to an embodiment of the present invention;

[0031] Figure 14 It is a structural block diagram of a computer terminal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following interpretations:

[0035] Kubernetes (K8S) is an open source system for automatically deploying, scaling, and managing containerized applications.

[0036] The network proxy container (Sidecar) can be used to provide additional functions for the main container without changing the main container. It can be deployed in the same container group (Pod) as the business container (non-Sidecar container) and share the same lifecycle. It can provide auxiliary functions for the business container and can be used to intercept the network traffic of the business container and complete the network connection.

[0037] Gateway orchestration services can be used to provide a fully managed service mesh platform that can be used to provide containers with the ability to access other networks. This mesh can implement gateway orchestration services through open source systems such as Kubernetes.

[0038] Network services can be used to access the network and can be implemented with various gateways. For example, they can be implemented as a Virtual Private Cloud (VPC) gateway, which can be used to connect to another VPC.

[0039] The Domain Name System (DNS) is a basic service of the Internet that can be used to map domain names and Internet Protocol (IP) addresses to each other.

[0040] Example 1

[0041] According to an embodiment of the present invention, an embodiment of a method for accessing a private network is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] The method embodiment provided in the first embodiment of the present invention may be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The block diagram shows the use of the above Figure 1 The computer terminal (or mobile device) shown is an embodiment of a computing node in a computing environment 101 (which may be a cloud computing environment). Figure 1 is a structural block diagram of a cloud computing environment according to an embodiment of the present invention, such as Figure 1 As shown, a cloud computing environment can include multiple services 120 (illustrated as 120-1, 120-2, ...) deployed and running on a distributed network of computing nodes (e.g., servers). Each computing node contains local processing and memory resources, allowing end users 102 to remotely run applications or store data in the cloud computing environment. Applications can be provided as multiple services 120-1, 120-2, 120-3, and 120-4 in computing environment 101, representing services "A," "D," "E," and "H," respectively.

[0043] End users 102 can provide and access services through a web browser or other software applications on the user side. In some embodiments, the provisioning and / or requests of end users 102 can be provided to the ingress gateway 130. The ingress gateway 130 can include a corresponding agent to handle the provisioning and / or requests for services 120 (one or more services provided in the computing environment 101).

[0044] The service 120 is provided or deployed based on various virtualization technologies supported by the computing environment 101. In some embodiments, the service 120 can be provided based on virtual machine (VM)-based virtualization, container-based virtualization, and / or similar methods. Virtual machine-based virtualization can simulate a real computer by initializing a virtual machine, executing programs and applications without directly accessing any actual hardware resources. While virtual machines virtualize machines, container-based virtualization can start containers to virtualize the entire operating system (OS) so that multiple workloads can run on a single operating system instance.

[0045] In an embodiment based on container virtualization, several containers of service 120 can be assembled into a POD (e.g., Kubernetes POD). Figure 1 As shown, service 120-2 may be equipped with one or more PODs 140-1, 140-2, ..., 140-N (collectively referred to as PODs 140). Each POD 140 may include a proxy 145 and one or more containers 142-1, 142-2, ..., 142-M (collectively referred to as containers 142). One or more containers 142 in POD 140 process requests related to one or more corresponding functions of the service, and proxy 145 generally controls network functions related to the service, such as routing, load balancing, etc. Other services 120 may also be equipped with PODs similar to POD 140.

[0046] During operation, executing a user request from the end user 102 may require calling one or more services 120 in the computing environment 101, and executing one or more functions of a service 120 may require calling one or more functions of another service 120. Figure 1 As shown, service “A” 120 - 1 receives a user request from end user 102 from ingress gateway 130 , service “A” 120 - 1 may call service “D” 120 - 2 , and service “D” 120 - 2 may request service “E” 120 - 3 to perform one or more functions.

[0047] This computing environment can be a cloud computing environment, where resource allocation is managed by the cloud service provider, allowing for feature development without having to worry about implementing, adjusting, or scaling servers. This computing environment allows developers to execute code in response to events without building or maintaining complex infrastructure. Services can be partitioned to perform a set of functions that can scale independently and automatically, rather than scaling a single hardware device to handle the potential load.

[0048] exist Figure 1 Under the operating environment shown, the present invention provides an application Figure 2 It should be noted that the method for accessing the private network of this embodiment can be Figure 1 The illustrated embodiment is executed by a mobile terminal.

[0049] Figure 2 FIG. 1 is a flow chart of a method for accessing a private network according to an embodiment of the present invention. Figure 2 As shown, the method may include the following steps:

[0050] Step S202: Obtain a domain name resolution request from a client, where the client is an access terminal to access a private network.

[0051] In the technical solution provided in the above step S202 of the present invention, a domain name resolution request can be obtained from the client, wherein the client can be an access terminal of the private network to be accessed, and can include a mobile device, a network client, etc., which is only for example and not specifically limited; the domain name resolution request can be a request for resolving a domain name, for example, it can be a request initiated for a Hyper Text Transfer Protocol (HTTP) resource (http(s)) or a request initiated for a non-http(s) resource, etc., which is only for example and not specifically limited to the type of request, and the private network can be a virtual private network (Virtual Private Cloud, VPC).

[0052] For example, you can open a browser on a mobile device (computer), enter a domain name, and the client can send a domain name resolution request to the server to obtain the client's domain name resolution request.

[0053] Step S204: Determine whether the domain name resolution request complies with the domain name format of the private network.

[0054] In the technical solution provided in step S204 of the present invention, the obtained domain name resolution request can be parsed to determine whether the domain name resolution request conforms to the domain name format of the private network, where the domain name format may include a host name format, for example, vpc1...), a gateway orchestration service format (for example, http(s) format, non-http(s) format).

[0055] Optionally, a Domain Name Server (DNS-proxy) may parse the domain name resolution request, thereby determining the domain name format of the domain name resolution request and determining whether the resolved domain name format complies with the domain name format of the private network.

[0056] Step S206: Allocate a virtual address corresponding to the domain name format to the private network.

[0057] In the technical solution provided in the above step S206 of the present invention, if it is determined that the domain name resolution request conforms to the domain name format of the private network, a virtual address corresponding to the domain name format can be allocated to the private network, wherein the virtual address can be an allocated virtual Internet Protocol address (Virtual IP, abbreviated as VIP).

[0058] For example, the domain name format of the domain name resolution request can be analyzed by the domain name-proxy server. If the domain name format of the domain name resolution request conforms to the domain name format of the private network (which can be the domain name format of the gateway orchestration service), the domain name-proxy server can assign a virtual Internet Protocol address to the transport-proxy server (transport-proxy), where the VIP network segment can be selected from a segment that does not conflict with the network segment of the user cluster, for example, it can be 21.0.0.0 / 8. The data segment here is only for example and is not specifically limited.

[0059] For example, you can access an online database service (Relational Database Service, abbreviated as RDS) in a network service named vpc1. The original address (domain name) of the online database service can be rds.a.com, and the address after encoding the network service name and additional parameters can be: rds.a.com.vpc1...

[0060] Step S208 , in response to the resource access request from the client, the target domain name of the private network is parsed from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent the target address of the private network.

[0061] In the technical solution provided in the above step S208 of the present invention, a resource access request from the client is obtained. In response to the resource access request from the client, the target domain name of the private network can be resolved from the virtual address, wherein the resource access request can be a request initiated by an application to a virtual Internet Protocol address, a request for accessing other client resources, or an http request, for example, it can be www.a.com.vpc1.http.....; the target domain name can be an encoded domain name, which can be used to represent the target address of the private network, for example, it can be a new target address represented by a domain name; the new target address can be the target address or server to which the client needs to access resources, etc., and no specific restrictions are made here.

[0062] Optionally, a resource access request may be initiated by an application in the client. In response to the resource access request initiated from the client, a target domain name in the private network used to represent a target address of the private network may be resolved from the virtual address.

[0063] Optionally, the application can access the encoded target domain name (new destination address) to achieve the purpose of opening up the network, and the domain name of the private network can be encoded into the original destination to achieve the purpose of easily accessing the private network.

[0064] Step S210 , based on the original domain name of the private network corresponding to the target domain name, access network resources in the private network, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network.

[0065] In the technical solution provided in step S210 of the present invention, the target domain name of the private network can be parsed from the virtual address, the original domain name of the private network corresponding to the target domain name can be determined, and network resources in the private network can be accessed based on the original domain name. The domain name format can be used to encode the original domain name into the target domain name. The original domain name can be used to represent the original address of the private network, and can be the original address before encoding, for example, rds.a.com; the network resource can be a custom resource, for example, a custom resource for a network service. This is only an example and is not specifically limited.

[0066] Optionally, the original domain name of the private network (network service) can be encoded. For example, a network tag (vpc1...) can be added after the original destination address of the network service. The newly added network tag can be composed of the name of the network service (vpc1) and some additional parameters (such as the gateway orchestration service name), making it a new destination address (destination domain name) represented by a domain name. Based on the destination domain name, resources in other networks can be accessed to the desired destination (network resources in the private network).

[0067] For example, to access a private network named vpc1 in the network service, the original domain name (original address) of the private network is www.a.com. The address after encoding the original address and additional parameters (target domain name) is www.a.com.vpc1.http..... Then, you can access network resources in the private network based on the original domain name www.a.com corresponding to www.a.com.vpc1.http.....

[0068] It should be noted that the above coding content is only for illustration and no specific limitation is given here.

[0069] Through the above steps S202 to S208 of the present invention, a domain name resolution request from a client is obtained, wherein the client is an access end of a private network to be accessed; it is determined that the domain name resolution request conforms to the domain name format of the private network; a virtual address corresponding to the domain name format is allocated to the private network; in response to a resource access request from the client, a target domain name of the private network is resolved from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent the target address of the private network; based on the original domain name of the private network corresponding to the target domain name, network resources in the private network are accessed, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network. In other words, the embodiment of the present invention determines the domain name format that conforms to the private network based on the domain name resolution request of the client, determines the virtual address corresponding to the domain name format based on the domain name format of the private network, obtains the resource access request that conforms to the domain name format issued by the client, resolves the target domain name of the private network from the virtual address based on the resource access request, and accesses the network resources in the private network based on the original domain name of the private network corresponding to the target domain name, thereby achieving the technical effect of improving the efficiency of network connection and solving the technical problem of low network connection efficiency.

[0070] The above method of this embodiment is further introduced below.

[0071] As an optional implementation, the domain name field of the original domain name and the resource field of the network resource are determined; and a domain name format is established based on the domain name field and the resource field.

[0072] In this embodiment, the original domain name field and the resource field of the network resource can be determined, and the domain name format can be established based on the domain name field and the resource field. The domain name field can be used to represent the service in the network service, for example, it can be used to represent the online database service named vpc1 or the HTTP service named vpc1 in the network service, etc. This is only an example and does not impose specific restrictions on the domain name field; the resource field can be used to represent the location of the network resource, and can include the host name of the original destination, for example, it can be a custom field

[0073] As an optional implementation, a domain name format is established based on the domain name field and the resource field, including: extracting the attribute field of the network resource from the resource field, wherein the attribute field is used to represent the name of the network resource and / or the type of the network resource; and splicing the attribute field to the end of the domain name field to obtain the domain name format.

[0074] In this embodiment, the attribute field of the network resource can be extracted from the resource field, and the attribute field can be spliced to the end of the domain name field to obtain the domain name format, wherein the resource field can include the attribute field; the attribute field can be used to represent the name of the network resource (for example, a field named vpc1) and / or the type of the network resource (for example, http service).

[0075] For example, the domain name field of the original domain name may be the field of rds.a.com, and the attribute field of the network resource may be the field of vpc1. The attribute field may be concatenated to the end of the domain name field to obtain the domain name format of rds.a.com.vpc1….

[0076] For another example, the domain name field of the original domain name may be the field of www.a.com, and the attribute field of the network resource may be the field of .vpc1.http. The attribute field may be concatenated to the end of the domain name field to obtain the domain name format of www.a.com.vpc1.http...

[0077] As an optional implementation, it is detected whether the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource; if it is detected that the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource, it is determined that the domain name resolution request conforms to the domain name format, wherein the name of the network resource and / or the type of the network resource is located at the end of the original domain name.

[0078] In this embodiment, the original domain name can be detected in response to the domain name resolution request to determine whether the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource. It is determined whether the detected domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource. If the detected domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource, it can be determined that the domain name resolution request conforms to the domain name format, wherein the name of the network resource and / or the type of the network resource can be located at the end of the original domain name.

[0079] For example, when https: / / www.taobao.com is opened on a browser, the domain name resolution server can resolve the original domain name of www.taobao.com in response to the domain name resolution request. If it is detected that the domain name resolution request includes the original domain name, as well as the name and / or type of the network resource, it is determined that the domain name resolution request conforms to the domain name format.

[0080] As an optional implementation, step S206, allocating a virtual address corresponding to the domain name format to the private network, includes: determining the first network segment where the client is currently located; determining a second network segment different from the first network segment; and allocating a virtual address corresponding to the domain name format and located on the second network segment to the private network.

[0081] In this embodiment, the first network segment where the client is currently located can be determined, and a virtual address corresponding to the domain name format and located on the second network segment can be assigned to the private network, wherein the second network segment and the first network segment are network segments at different locations, and the first network segment and the second network segment are different.

[0082] Optionally, the domain name-proxy server may allocate a virtual address corresponding to the domain name format to the private network, and the network segment of the virtual address may be selected to be a network segment that does not conflict with the network segment of the client (user cluster).

[0083] In related technologies, connecting the three-layer network will change the network infrastructure environment within the application. For example, new routing rules need to be added, but the new routing rules will cause conflicts with the network segments of the existing network. In an embodiment of the present invention, the first network segment where the client is currently located is determined, and a virtual address of the second network segment corresponding to the domain name format and different from the first network segment is allocated to the private network, thereby avoiding network segment conflicts between existing networks, achieving the technical effect of improving network connection efficiency, and solving the technical problem of low network connection efficiency.

[0084] As an optional implementation, in response to a resource access request being transmitted in accordance with the Hypertext Transfer Protocol, the resource access request is cleansed, wherein the cleansed resource access request conforms to the original domain name format of the private network; based on the cleansed resource access request, the original domain name corresponding to the target domain name is resolved from the virtual address.

[0085] In this embodiment, it can be determined whether the resource access request is transmitted in accordance with the Hypertext Transfer Protocol. In response to the resource access request being transmitted in accordance with the Hypertext Transfer Protocol, the resource access request can be cleaned to obtain the original domain name format that conforms to the private network. Based on the cleaned resource access request, the original domain name corresponding to the target domain name can be parsed from the virtual address, where the original domain name format can be the domain name of the original address before encoding; the resource access request can include the format of the gateway orchestration service in the server name indication (SNI).

[0086] Optionally, if the resource access request is transmitted in accordance with the Hypertext Transfer Protocol, in response to the resource access request being transmitted as a Hypertext Transfer Protocol request (for example, www.a.com.vpc1.http.....), the resource access request can be cleaned using the communication bus (envoy). For example, the format of the gateway orchestration service in the https request can be removed. The cleaned resource access request conforms to the original domain name format of the private network (the original address before encoding). Based on the cleaned resource access request, the original domain name corresponding to the target domain name can be resolved from the virtual address.

[0087] In an embodiment of the present invention, resource access requests are cleaned to avoid problems in the virtual host matching process. At the same time, the encoding part in the TLS SNI can be cleaned up to avoid TLS handshake failure, thereby improving the efficiency of network connection.

[0088] Optionally, the transport-proxy server may parse the assigned VIP, parse out the encoded domain name, and parse out the name of the network service therefrom to determine the original destination.

[0089] As an optional implementation, resolving the original domain name corresponding to the target domain name from the virtual address includes: resolving an identifier corresponding to the original domain name from the socket of the private network; and resolving the original domain name from the virtual address based on the identifier.

[0090] In this embodiment, the identifier corresponding to the original domain name can be parsed from the socket of the private network, and the original domain name can be parsed from the virtual address based on the identifier, wherein the socket can be (socket) and the identifier can be mark information (MarkId).

[0091] Optionally, a marking information (MarkId) can be exchanged with the existing gateway control plane component in the gateway orchestration service based on the network service. After obtaining the MarkId, a socket can be created and the marking information can be placed in the socket. The network security management-proxy server can parse the marking information from the socket through a traffic control (Traffic Control, abbreviated as TC) rule and put it in the last 24 bits of the destination media access control address (Media Access Control, abbreviated as MAC) of the network packet; the gateway data plane component can finally resolve the target network service through the destination MAC address, and resolve the original domain name from the virtual address based on the identifier.

[0092] As an optional implementation, step S210, based on the original domain name of the private network corresponding to the target domain name, accesses the network resources in the private network, including: accessing the private network based on a virtual extended LAN, and accessing the network resources in the private network according to the original domain name.

[0093] In this embodiment, a private network can be accessed based on a virtual extensible local area network (VxLan), and resources in the private network can be accessed according to the original domain name.

[0094] Optionally, the original domain name is resolved from the virtual address based on the identifier, and the network service is connected through VxLan, thereby realizing the connection of the private network.

[0095] As an optional implementation, the duration of the disconnection between the client and the virtual address is obtained; in response to the disconnection duration being greater than a duration threshold, the virtual address is deleted.

[0096] In this embodiment, the duration of the connection disconnection between the client and the virtual address can be obtained, and in response to the connection disconnection duration being greater than a duration threshold, the virtual address can be deleted, wherein the time threshold can be a value set based on actual needs, for example, it can be 100 seconds. This is only an example and no specific limitation is made; the connection disconnection duration can be the domain name cache time (Time To Live, abbreviated as TTL).

[0097] Optionally, a domain name resolution aging mechanism can be designed using the transmission-proxy server and the domain name-proxy server. The domain name cache time returned by the domain name-proxy server can be set. When the cache time is up, it will automatically age. The user does not need to maintain port mapping resources, avoiding resource waste.

[0098] For example, the domain name cache time returned by the domain name-proxy server can be 60 seconds. The transmission-proxy server will expire the VIP after the VIP connection is disconnected for 60 seconds. The user does not need to maintain the port mapping resources, thus avoiding resource waste.

[0099] As an optional implementation, obtaining a domain name resolution request from a client includes: obtaining a domain name resolution request from a business container of the client in a network proxy container, wherein the network proxy container and the business container share the same operating cycle, and the client accesses the private network through the business container; and resolving a target domain name of the private network from a virtual address in response to a resource access request from the client, including: resolving a target domain name from a virtual address in response to a resource access request from the business container of the client.

[0100] In this embodiment, the client can access the private network through the service container, the service container from the client can be obtained in the network proxy server, the network proxy container and the service container can share the same operating cycle, and the client can access the private network through the service container.

[0101] Optionally, a resource access request from a service container of a client may be responded to, so as to resolve a target domain name from a virtual address.

[0102] In an embodiment of the present invention, a network proxy container is used to intercept the traffic of a business container to open up the network, a private network is encoded in a domain name, and network proxy container interception technology is used to complete network penetration of the business container, thereby reducing the access cost on the application program, thereby achieving the technical effect of improving the efficiency of network connection and solving the technical problem of low network connection efficiency.

[0103] In an embodiment of the present invention, a domain name format that conforms to the private network is determined based on a domain name resolution request from a client, a virtual address corresponding to the domain name format is determined based on the domain name format of the private network, a resource access request that conforms to the domain name format issued by the client is obtained, a target domain name of the private network is resolved from the virtual address based on the resource access request, and network resources in the private network can be accessed based on the original domain name of the private network corresponding to the target domain name, thereby achieving a technical effect of improving the efficiency of network connection and solving the technical problem of low efficiency of network connection.

[0104] The following describes how to access a private network from the perspective of encoding the domain name.

[0105] Figure 3 FIG. 1 is a flow chart of another method for accessing a private network according to an embodiment of the present invention. Figure 3 As shown, the method may include the following steps:

[0106] Step S302: Acquire the original domain name of the private network, where the original domain name is used to represent the original address of the private network.

[0107] In the technical solution provided in step S302 of the present invention, the original domain name of the private network can be obtained, wherein the original domain name can be used to represent the original address of the private network; the original address can be the name of the created network service, for example, vpc1.

[0108] Optionally, an administrator can create a network service to complete the preparation of the network service. It can be assumed that the name of the network service is the resource name of the private network (vpc1), thereby obtaining the original domain name of the private network. The network service can be used to complete the processing and forwarding of resources in the private network.

[0109] Step S304: Encode the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent a target address of the private network.

[0110] In the technical solution provided in step S304 of the present invention, the original domain name can be encoded according to the domain name format of the private network to obtain the target domain name of the private network, wherein the target domain name can be used to represent the target address of the private network.

[0111] Optionally, the original domain name can be encoded according to the domain name format of the private network. For example, a network tag (vpc1...) can be added after the original destination address (original domain name). The newly added network tag can be composed of the name of the network service (vpc1) and some additional parameters, making it a new destination address represented by a domain name (the target domain name of the private network). In this way, based on the target domain name, resources in other networks can be accessed to the desired destination.

[0112] In step S306, the target domain name is sent to the client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0113] In the technical solution provided in the above step S306 of the present invention, the target domain name can be sent to the client, so that the client can send a domain name resolution request in the domain name format based on the target domain name, as well as a resource access request that conforms to the domain name format. A virtual address corresponding to the domain name format can be allocated to the private network based on the domain name resolution request. The target domain name of the private network can be resolved from the virtual address based on the resource access request, and the original domain name corresponding to the target domain name can be used to access network resources in the private network.

[0114] Optionally, the application can access the encoded domain name (new destination address) to achieve the purpose of opening up the network, and encode the domain name of the target private network into the original destination to achieve easy access to the target private network. The encoding work can be completed in advance before being sent to the application.

[0115] For example, you can open a URL (such as https: / / www.taobao.com) on a browser and use a domain name resolution server to resolve the URL to obtain the Internet Protocol address of the domain name www.taobao.com for machine recognition. Based on the identified Internet Protocol address, the browser can initiate a domain name resolution request that conforms to the domain name format to a specific Internet Protocol address, as well as a resource access request that conforms to the domain name format.

[0116] Through steps S302 to S306 of the present invention, the original domain name of the private network is obtained, wherein the original domain name is used to represent the original address of the private network; the original domain name is encoded according to the domain name format of the private network to obtain the target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; the target domain name is sent to the client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network, thereby achieving the technical effect of improving the efficiency of network connection and solving the technical problem of low network connection efficiency.

[0117] The embodiment of the present invention further provides another method for accessing a private network, which can be applied to a software-as-a-Service (SaaS) side.

[0118] Figure 4 FIG. 1 is a flow chart of another method for accessing a private network according to an embodiment of the present invention. Figure 4 As shown, the method may include the following steps.

[0119] Step S402: Acquire the original domain name of the private network by calling a first interface, wherein the first interface includes a first parameter, the parameter value of the first parameter is the original domain name, and the original domain name is used to represent the original address of the private network.

[0120] In the technical solution provided in step S402 of the present invention, the first interface may be an interface for data interaction between the server and the user terminal. The user terminal may use the original domain name of the private network as a first parameter of the first interface to achieve the purpose of obtaining the original domain name of the private network.

[0121] Step S404: Encode the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent a target address of the private network.

[0122] Step S406: The target domain name is sent to the client by calling the second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the second interface includes a second parameter, the parameter value of the second parameter is the target domain name, the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0123] In the technical solution provided in the above step S406 of the present invention, the second interface can be an interface for data interaction between the server and the user end. The server can send the target domain name to the client, so that the client sends a domain name resolution request that conforms to the domain name format based on the target domain name, and a resource access request that conforms to the domain name format is passed into the second interface as a parameter of the second interface, thereby achieving the purpose of sending the domain name resolution request that conforms to the domain name format and the resource access request that conforms to the domain name format to the user end.

[0124] Figure 5 FIG. 1 is a schematic diagram of a computer device accessing a private network according to an embodiment of the present invention. Figure 5 As shown, the original domain name of the private network can be obtained by calling the first interface, and the computer device encodes the original domain name according to the domain name format of the private network to obtain the target domain name of the private network, wherein the target domain name is used to represent the target address of the private network, and the target domain name is sent to the client by calling the second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name. The domain name resolution request that conforms to the domain name format and the resource access request that conforms to the domain name format obtained by calling the second interface output can be output.

[0125] Optionally, the platform can call the second interface to output a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format, wherein the second interface can be used to send the target domain name to the client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name.

[0126] An embodiment of the present invention obtains the original domain name of a private network by calling a first interface, wherein the first interface includes a first parameter, the parameter value of the first parameter is the original domain name, and the original domain name is used to represent the original address of the private network; the original domain name is encoded according to the domain name format of the private network to obtain the target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; the target domain name is sent to the client by calling a second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the second interface includes a second parameter, the parameter value of the second parameter is the target domain name, the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network, thereby achieving the technical effect of improving the efficiency of network connection and solving the technical problem of low network connection efficiency.

[0127] Example 2

[0128] According to an embodiment of the present invention, there is also provided an embodiment of a system for accessing a private network. Figure 6 Schematic diagram of a private network access system according to an embodiment of the present invention. Figure 6 As shown, the system may include: a client 601, a network proxy container 602 and a gateway 603, wherein:

[0129] The client 601 may be used to send a domain name resolution request to the network proxy container, wherein the client may be an access end of a gateway to be accessed, for example, an application.

[0130] The network proxy container 602 can be used to determine whether the domain name resolution request conforms to the domain name format of the gateway, and can assign a virtual address corresponding to the domain name format to the gateway; in response to a resource access request from the client, the target domain name of the gateway can be resolved from the virtual address, wherein the resource access request can conform to the domain name format, and the target domain name can be used to represent the target address of the private network; network resources in the gateway can be accessed based on the original domain name of the gateway corresponding to the target domain name, wherein the domain name format can be used to encode the original domain name into the target domain name, and the original domain name can be used to represent the original address of the private network, wherein the network proxy container can be a network proxy container that can be used to provide additional functions to the main network proxy container, for example, it can be a network proxy container in a network security manager-proxy (nsm-proxy for short).

[0131] Gateway 603 can be used to return network resources to the network proxy container and can be a VPC gateway.

[0132] As an optional embodiment, the network proxy container may include: a request interception component, which can be used to detect whether the domain name resolution request includes the original domain name, and the name and / or type of the network resource. If it is detected that the domain name resolution request includes the original domain name, and the name and / or type of the network resource, it can be determined that the domain name resolution request conforms to the domain name format, wherein the name and / or type of the network resource can be located at the end of the original domain name in the domain name resolution request.

[0133] Optionally, the request interception component can be a Domain Name Server (DNS-proxy), which can be used to intercept the domain name resolution request of the network proxy container, complete the domain name resolution first, then initiate a Hypertext Transfer Protocol (http(s)) request and return a virtual IP address

[0134] As an optional embodiment, the network proxy container may include: a transmission component, which can be used to determine the first network segment where the client is currently located; determine a second network segment different from the first network segment; and allocate a virtual address corresponding to the domain name format and located on the second network segment to the private network.

[0135] Optionally, the transport component may be a transport-proxy server that can be used to resolve the virtual IP address back to the original destination and connect the data stream to the data plane of the gateway orchestration service.

[0136] As an optional embodiment, the network proxy container may include: a cleaning component, which can be used to clean the resource access request in response to the resource access request being transmitted in accordance with the Hypertext Transfer Protocol, wherein the cleaned resource access request can conform to the original domain name format of the private network.

[0137] Optionally, the transmission component can also be used to resolve the original domain name corresponding to the target domain name from the virtual address based on the cleaned resource access request.

[0138] Optionally, the cleaning component can be a communication bus (envoy), which can be used to clean http(s) requests. It can change the host field of the Hypertext Transfer Protocol back to the original address before encoding to avoid problems with virtual host matching. At the same time, it can clean up the encoded part of the Server Name Indication (SNI) of the Transport Layer Security (TLS) to avoid failure of the Transport Layer Security handshake.

[0139] In an embodiment of the present invention, a sidecar container is added to the gateway orchestration service. The sidecar container can be automatically injected into the business container through a network hook or the network proxy container creation capability of a cloud-native application automation engine, thereby achieving the technical effect of improving the efficiency of network connectivity and solving the technical problem of low network connectivity efficiency.

[0140] In this embodiment, a private network access system is provided, wherein a client is used to send a domain name resolution request to a network proxy container; the network proxy container is used to determine whether the domain name resolution request complies with the domain name format of the gateway and allocate a virtual address corresponding to the domain name format to the gateway; in response to a resource access request from the client, the target domain name of the gateway is resolved from the virtual address; based on the original domain name of the gateway corresponding to the target domain name, network resources in the gateway are accessed; the gateway is used to return network resources to the network proxy container, so that the domain name format that complies with the private network can be determined based on the domain name resolution request of the client, the virtual address corresponding to the domain name format is determined based on the domain name format of the private network, the resource access request that complies with the domain name format issued by the client is obtained, the target domain name of the private network is resolved from the virtual address based on the resource access request, and the network resources in the private network can be accessed based on the original domain name of the private network corresponding to the target domain name, thereby achieving the technical effect of improving the efficiency of network connection and solving the technical problem of low efficiency of network connection.

[0141] Example 3

[0142] Currently, the problem of a client accessing a service in another private network can be solved by connecting the client and server networks at three layers. For example, Cloud Enterprise Network (CEN) and virtual private cloud are all based on three-layer network connection to enable applications in the client to access services in another private network. However, the three-layer network connection will change the network infrastructure environment within the application. For example, new routing rules need to be added, but the new routing rules will cause conflicts with the network segments of the existing network. This method has problems such as low configuration efficiency and limited connected private networks. In addition, this method has strict restrictions on the Classless Inter-Domain Routing (CIDR) division of each network, and there is a problem that it cannot be completely overlapped.

[0143] Related technologies also propose a way to connect based on port mapping, that is, to solve the service problem in the private network by means of port mapping, such as Destination Network Address Translation (DNAT), Private Link, etc. Figure 7 This is a schematic diagram of the port mapping process in the related art, such as Figure 7As shown, this method needs to be responsible for providing a network element (proxy) at the network layer that can enable the two networks to communicate with each other. This network element can provide a protocol + IP + port (port) accessible within the local private network 1. When all requests within the local private network reach this port, they will be forwarded to a protocol + IP + port on the opposite network (for example, private network 2).

[0144] For example, if Figure 7 As shown, port 1 (port1) of the gateway can provide a protocol + IP + port (192.168.1.100:80) accessible in the local private network 1. When the user (Client) sends a request 1 in the private network 1 (192.168.1.0 / 24), the request 1 will be forwarded to the server 1 (server1) in the private network 2 (172.16.1.0 / 24) with the protocol + IP + port of 172.16.1.1:8080 after arriving at port 1.

[0145] For example, Figure 7 As shown, port 2 (port2) of the gateway can provide a protocol + IP + port (192.168.1.100:8080) accessible in the local private network 1. When the user (Client) sends a request 2 in the private network 1 (192.168.1.0 / 24), the request 2 will be forwarded to the server 2 in the private network 2 with the protocol + IP + port 172.16.1.2:8080 after arriving at port 2.

[0146] As can be seen from the above, the port mapping method requires changing the original destination address and port. If the service address contains some routing matching rules based on the host (HOST), for example, the virtual host of the reverse proxy service (nginx), the Transport Security Protocol Server Name Indication (TLS SNI) will fail. And each time a destination is added, it is necessary to open the port in the corresponding network configuration, which leads to low configuration efficiency and the highest accessible destination is limited by the capacity of the central network facilities. Therefore, it is not suitable for scenarios with massive short requests that need to be processed. At the same time, this method needs to pay attention to the life cycle of the port, otherwise there is a risk of port resource leakage. In addition, the mapping configuration behavior often does not allow application developers to operate port mapping, and needs to be handled by the cluster administrator, resulting in inflexible application.

[0147] Related technologies also propose a method based on application proxy, such as Hyper Text Transfer Protocol proxy (HTTP proxy) and socks5 proxy. This method requires deep modification of user code, and its application scope is limited by whether the software development kit (SDK) supports such proxy. Its scope of use is limited. In a production environment, when facing a multi-tenant production environment, a container (Pod) may have network access requirements for multiple private networks at the same time, and the number of private networks will increase with the increase of tenants. Therefore, this method still has the problem of high access cost.

[0148] In order to solve the problem in related technologies that, when a client accesses a service in another private network, there is a lack of a low access cost, low solution flexibility and the inability to meet the production environment of multi-tenant scenarios, an embodiment of the present invention proposes a method for connecting a private network using domain name encoding. The network connection is completed by using a domain name server to perform domain name encoding, wherein the domain name server can be used to convert domain names and their corresponding IP addresses.

[0149] In an embodiment of the present invention, if an application wishes to access resources within a private network, it may only need to modify the access destination. For example, a network tag may be added after the original destination address to make it a new destination address represented by a domain name, thereby enabling access to resources within other networks. The newly added network tag may be composed of a network service and some additional parameters. The coding work may be completed in advance before being sent to the application program. However, in most cases, the code for accessing the service does not need to be modified.

[0150] The following further introduces the device for connecting to a private network using domain name encoding proposed in an embodiment of the present invention.

[0151] In this embodiment of the present invention, a network proxy container (Sidecar container) is added to the gateway orchestration service. The network proxy container can be automatically injected into the business container through a webhook or the creation (Sidecar Set) capability of the network proxy container of the cloud native application automation engine.

[0152] Figure 8 Schematic diagram of connecting a private network system according to an embodiment of the present invention. Figure 8As shown, the gateway orchestration service may include: a gateway control plane component (Network Service Manager, abbreviated as NSMgr) and a gateway data plane component (Forwarder) that can be used to connect to VxLan. The gateway orchestration service can abstract the private network into a network service resource to achieve docking with the virtual extended LAN (VxLan) and complete the access of other private networks (for example, internal.a.com). The underlying implementation of the network service can be a group of containers (Pod) located in the target private network. This container can be provided to nodes of other private networks for access through the virtual extended LAN.

[0153] Optionally, since the embodiment of the present invention is constructed based on the gateway orchestration service, the method can also be applied to other scenarios with three-layer network connectivity.

[0154] In this embodiment, the network security manager-proxy (NSM-proxy for short) may be composed of three parts: a domain name-proxy server, a transport-proxy server, and a communication bus.

[0155] Optionally, a domain name-proxy server can be used to intercept the domain name resolution request of the container, complete the domain name resolution first, then initiate a Hypertext Transfer Protocol (http(s)) request and return a virtual IP address.

[0156] Optionally, the communication bus can be used to clean HTTP(S) requests, changing the host field of the Hypertext Transfer Protocol back to its original address before encoding to avoid problems with virtual host matching, and cleaning up the encoded part of the Server Name Indication of the Transport Security Protocol to avoid Transport Security handshake failures.

[0157] Optionally, a transport-proxy server can be used to resolve the virtual IP address back to the original destination and connect the data stream to the data plane of the gateway orchestration service.

[0158] The following further introduces the device for connecting to a private network by using a domain name code, which is proposed in an embodiment of the present invention, based on the device for connecting to a private network by using a domain name code.

[0159] FIG9( a ) is a flow chart of a method for establishing a private network according to an embodiment of the present invention. As shown in FIG9( a ), the method for establishing a private network may include the following steps.

[0160] Step S901: Create a network service.

[0161] In this embodiment, an administrator may create a network service and complete preparations for the network service. It may be assumed that the name of the network service is the resource name (vpc1).

[0162] Step S902: Obtain a new destination address.

[0163] In this embodiment, the network service can be encoded before being sent to the application. For example, a network tag (vpc1...) can be added after the original destination address of the network service. The newly added network tag can be composed of the name of the network service (vpc1) and some additional parameters, making it a new destination address represented by a domain name, which can access resources in other networks and reach the desired destination.

[0164] Optionally, the application can access the encoded domain name (new destination address) to achieve the purpose of opening up the network, encoding the domain name of the target private network into the original destination to achieve the purpose of easily accessing the target private network.

[0165] For example, the node access network service of other private networks may include format 1 (non-http(s) request) and format 2 (http(s) request). Optionally, the original destination host name of format 1 may be: / IP...

[0166] For example, you can access an online database service (Relational Database Service, abbreviated as RDS) in a network service named vpc1. The original address (domain name) can be rds.a.com, and the address after encoding the network service name and additional parameters can be: rds.a.com.vpc1..., where vpc1... can be in the host name format.

[0167] For another example, when accessing the HTTP service named vpc1 in the network service, the original address (domain name) of the HTTP service can be: www.a.com, then the address (domain name) after encoding the original address and additional parameters can be www.a.com.vpc1.http.....

[0168] It should be noted that the above-mentioned coding content and type are only examples and are not specifically limited here.

[0169] Step S903: inject destination address translation rules.

[0170] In this embodiment, when the network security management-proxy server network proxy container is started, a destination address translation (DNAT) rule can be injected into the container. Destination Address Translation (DNAT) is a type of firewall port mapping method. After the destination address translation rule is entered, the port traffic accessing one or more destination addresses can be forwarded to a specific IP+port.

[0171] Optionally, during the domain name resolution phase, such as Figure 8 As shown, all requests for the User Datagram Protocol (UDP) 53 port and the Transmission Control Protocol (TCP) 53 port accessed by the user can be forwarded to the domain name-proxy server (127.0.0.1:5353) to complete the purpose of intercepting the domain name resolution request of the container and returning a virtual IP address, so that requests for UDP 53 port and TCP 53 port of any address can be forwarded to the 127.0.0.1:5353 port of the domain name-proxy server, where the domain name resolution request can be an access request at the domain name resolution node. It should be noted that the above numbers are only for example and are not specifically limited here.

[0172] Optionally, a domain name resolution request can be obtained, the domain name can be resolved, and the resolved domain name can be converted into an IP address, so that the client can connect to the remote server based on the IP address. Only after the domain name is resolved to obtain the Internet Protocol address can a resource request (http(s) request) be initiated to the Internet Protocol address.

[0173] For example, you can open a URL (such as https: / / www.taobao.com) on a browser, use a domain name resolution server to resolve the URL, and obtain the Internet Protocol address of the domain name www.taobao.com for machine recognition. The browser can initiate an access request to a specific Internet Protocol address based on the identified Internet Protocol address.

[0174] Step S904: intercepting the domain name and the traffic of the network proxy container.

[0175] In this embodiment, the domain name format can be analyzed by the domain name-proxy server. If the domain name resolution request does not conform to the format of the gateway orchestration service (which may include format 1 and format 2), the domain name-proxy server can directly forward the request to the local address of the socket; if the domain name format of the domain name resolution request conforms to the format of the gateway orchestration service, the domain name-proxy server will assign a virtual Internet Protocol address to the transport-proxy server, where the VIP network segment will select a segment that does not conflict with the network segment of the user cluster, such as 21.0.0.0 / 8. The data segment here is only for example and is not specifically limited.

[0176] Step S905: Map the domain name to a virtual address.

[0177] In this embodiment, after the domain name resolution request in the domain name server instruction (DNS Query) is returned, the application can initiate a request (http request) to the virtual IP address (VIP) assigned by the transport-proxy server, and the IP segment where the VIP is located will hit the designed transparent proxy (transparent proxy, referred to as tproxy) rules.

[0178] Alternatively, as Figure 8 As shown in the figure, if it is a non-http request, the traffic can directly enter the transport-proxy server through the tproxy rule; if it is an http request, the traffic can first enter envoy and then enter transport-proxy through the tproxy rule.

[0179] For example, if Figure 8 As shown, for HTTP requests (such as www.a.com.vpc1.http.....), Envoy can remove the format of the gateway orchestration service in the host and server name indication (SNI). It can change the host field of HTTP back to the original address before encoding to avoid problems with virtual host matching; it will also clean up the encoded part in TLS SNI to avoid TLS handshake failure; you can set mark: 2676 in the socket to prevent the outgoing traffic from returning to the communication bus again; the request sent out by the communication bus will be transmitted to the transport-proxy server by the transparent proxy.

[0180] Step S906: parse the original destination from the allocated virtual address.

[0181] In this embodiment, the transport-proxy server can parse the assigned VIP, parse out the encoded domain name, and parse out the name of the network service from it to determine the original destination.

[0182] Figure 9(b) is a schematic diagram of parsing the original network service according to an embodiment of the present invention. As shown in Figure 9(b), the resource access request can be diagnosed through the Unified Diagnostic Services (UDS), and a tag information (MarkId) can be exchanged with the existing gateway control plane component in the gateway orchestration service according to the network service. After obtaining the MarkId, a socket is created and the tag information is placed in the socket. The network security management-proxy server can parse the tag information from the socket through a traffic control (TC) rule and put it in the last 24 bits of the media access control address (MAC) of the network packet; the gateway data plane component can finally resolve the target network service through the destination MAC address and connect to the network service through VxLan, thus realizing network connectivity.

[0183] Step S907: aging the virtual address.

[0184] In this embodiment, a domain name resolution aging mechanism can be designed using the transmission-proxy server and the domain name-proxy server. The domain name cache time returned by the domain name-proxy server can be set. When the cache time is up, it will automatically age. The user does not need to maintain port mapping resources, thus avoiding resource waste.

[0185] For example, the domain name cache time returned by the domain name-proxy server can be 60 seconds. The transmission-proxy server will expire the VIP after the VIP connection is disconnected for 60 seconds. The user does not need to maintain the port mapping resources, thus avoiding resource waste.

[0186] The embodiment of the present invention adopts DNS technology, encodes the target private network into the original destination, and then cooperates with Sidecar technology to intercept the traffic of the business container to open up the network. The private network is encoded in the domain name, and the network penetration of the business container is completed using Sidecar traffic interception technology. Since DNS is a technology supported by mainstream operating systems, mainstream programming languages and SDKs by default, the access cost on the application is reduced.

[0187] In the related art, in order to access a destination, a global port needs to be consumed (for example, the port mapping method). However, in the embodiment of the present invention, after the network service is ready, the domain name interception and VIP mapping work both occur locally, and tens of thousands of destinations on the target private network can be easily accessed. In addition, this solution also has an elimination mechanism based on connection expiration, which does not require users to maintain port mapping resources. It is more friendly to massive short task requests, thereby achieving the technical effect of improving the efficiency of network connection and solving the technical problem of low efficiency of network connection.

[0188] In another optional embodiment, Figure 10 The block diagram shows the use of the above Figure 1 The computer terminal (or mobile device) shown is used as an embodiment of the service grid. Figure 10 is a structural block diagram of a service grid according to a method for processing access to a private network according to an embodiment of the present invention, such as Figure 10 As shown, the service grid 1000 is mainly used to facilitate secure and reliable communication between multiple microservices. Microservices refer to decomposing an application into multiple smaller services or instances and distributing them to run on different clusters / machines.

[0189] like Figure 10 As shown, the microservices may include application service instance A and application service instance B, which form the functional application layer of the service grid 1000. In one embodiment, application service instance A runs in the form of container / process 1008 on a machine / workload container group 1014 (POD), and application service instance B runs in the form of container / process 1010 on a machine / workload container group 1016 (POD).

[0190] In one implementation, application service instance A may be a product query service, and application service instance B may be a product ordering service.

[0191] like Figure 10As shown, application service instance A and grid proxy (sidecar) 1003 coexist in machine workload container group 1014, while application service instance B and grid proxy 1005 coexist in machine workload container 1014. Grid proxy 1003 and grid proxy 1005 form the data plane layer of service grid 1000. Grid proxy 10003 and grid proxy 1005 run as container / process 1004, which can receive requests 1012 for product query services, and grid proxy 1006, respectively. Bidirectional communication is possible between grid proxy 1003 and application service instance A, and between grid proxy 1005 and application service instance B. Furthermore, bidirectional communication is also possible between grid proxy 1003 and grid proxy 1005.

[0192] In one embodiment, all traffic for application service instance A is routed to the appropriate destination via grid proxy 1003, and all network traffic for application service instance B is routed to the appropriate destination via grid proxy 1005. It should be noted that network traffic mentioned herein includes, but is not limited to, Hypertext Transfer Protocol (HTTP), Representational State Transfer (REST), the high-performance, general-purpose open source framework (gRPC), the open source in-memory data structure storage system (Redis), and other forms.

[0193] In one embodiment, the functionality of the data plane layer can be extended by writing custom filters for the proxy (Envoy) in service mesh 1000. The service mesh proxy configuration can be designed to enable the service mesh to correctly proxy service traffic, achieve service interoperability and service governance. Mesh proxy 1003 and mesh proxy 1005 can be configured to perform at least one of the following functions: service discovery, health checking, routing, load balancing, authentication and authorization, and observability.

[0194] like Figure 10 As shown, the service grid 1000 also includes a control plane layer. The control plane layer can be a group of services running in a dedicated namespace, and these services are hosted by a hosting control plane component 1001 in a machine / workload container group (machine / Pod) 1002. Figure 10 As shown, managed control plane component 1001 communicates bidirectionally with grid agent 1003 and grid agent 1005. Managed control plane component 1001 is configured to perform certain control and management functions. For example, managed control plane component 1001 receives telemetry data transmitted by grid agent 1003 and grid agent 1005 and can further aggregate this telemetry data. In addition to these services, managed control plane component 1001 can also provide a user-oriented application programming interface (API) to easily manipulate network behavior and provide configuration data to grid agent 1003 and grid agent 1005. It should be noted that the aforementioned method embodiments are described as a series of actions for simplicity. However, those skilled in the art should understand that the present invention is not limited by the order of the actions described, as certain steps can be performed in a different order or simultaneously according to the present invention. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are preferred embodiments, and the actions and modules involved are not necessarily required for the present invention.

[0195] It should be noted that for the aforementioned method embodiments, for simplicity of description, they are all expressed as a series of action combinations. However, those skilled in the art should be aware that the present invention is not limited by the order of the actions described, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0196] Through the description of the above embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus the necessary general hardware platform, or of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0197] Example 4

[0198] According to an embodiment of the present invention, there is also provided a method for implementing the above Figure 2 The private network access method and the private network access device are shown.

[0199] Figure 11 Schematic diagram of a device for accessing a private network according to an embodiment of the present invention. Figure 11As shown, the private network access device 1100 may include: a first obtaining unit 1102 , a determining unit 1104 , an allocating unit 1106 , a parsing unit 1108 and an accessing unit 1110 .

[0200] The first acquiring unit 1102 is configured to acquire a domain name resolution request from a client, where the client is an access terminal to access a private network.

[0201] The determining unit 1104 is configured to determine whether the domain name resolution request complies with the domain name format of the private network.

[0202] The allocating unit 1106 is configured to allocate a virtual address corresponding to the domain name format to the private network.

[0203] The parsing unit 1108 is configured to parse a target domain name of the private network from the virtual address in response to a resource access request from the client, wherein the resource access request conforms to a domain name format and the target domain name is used to represent a target address of the private network.

[0204] The access unit 1110 is configured to access network resources in the private network based on the original domain name of the private network corresponding to the target domain name, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network.

[0205] It should be noted that the first acquisition unit 1102, determination unit 1104, allocation unit 1106, parsing unit 1108, and access unit 1110 described above correspond to steps S202 to S210 in Example 1. The examples and application scenarios implemented by these five units and the corresponding steps are the same, but are not limited to those disclosed in Example 1. It should be noted that the above units, as part of the apparatus, can be run in the computer terminal provided in Example 1.

[0206] According to an embodiment of the present invention, there is also provided a method for implementing the above Figure 3 The private network access method and the private network access device are shown.

[0207] Figure 12 Schematic diagram of another private network access device according to an embodiment of the present invention. Figure 12 As shown, the private network access device 1200 may include: a second obtaining unit 1202 , a first processing unit 1204 and a first issuing unit 1206 .

[0208] The second obtaining unit 1202 is configured to obtain an original domain name of the private network, where the original domain name is used to represent an original address of the private network.

[0209] The first processing unit 1204 is configured to encode the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent a target address of the private network.

[0210] The first sending unit 1206 is used to send the target domain name to the client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0211] It should be noted that the second acquisition unit 1202, the first processing unit 1204, and the first issuing unit 1206 correspond to steps S302 to S306 in Example 1. The examples and application scenarios implemented by the three units and the corresponding steps are the same, but are not limited to the contents disclosed in Example 1. It should be noted that the above units, as part of the device, can be run in the computer terminal provided in Example 1.

[0212] According to an embodiment of the present invention, there is also provided a method for implementing the above Figure 4 The private network access method and the private network access device are shown.

[0213] Figure 13 Schematic diagram of another private network access device according to an embodiment of the present invention. Figure 13 As shown, the private network access device 1300 may include: a third obtaining unit 1302 , a second processing unit 1304 and a second issuing unit 1306 .

[0214] The third obtaining unit 1302 is configured to obtain the original domain name of the private network by calling the first interface, wherein the first interface includes a first parameter, the parameter value of the first parameter is the original domain name, and the original domain name is used to represent the original address of the private network.

[0215] The second processing unit 1304 is configured to encode the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent a target address of the private network.

[0216] The second sending unit 1306 is used to send the target domain name to the client by calling the second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the second interface includes a second parameter, the parameter value of the second parameter is the target domain name, the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0217] It should be noted that the third acquisition unit 1302, the second processing unit 1304, and the second issuing unit 1306 correspond to steps S402 to S406 in Example 1. The examples and application scenarios implemented by the three units and the corresponding steps are the same, but are not limited to the contents disclosed in Example 1. It should be noted that the above units, as part of the device, can be run in the computer terminal provided in Example 1.

[0218] In the access device for the private network of this embodiment, a domain name resolution request from a client is obtained by a first acquisition unit; a determination unit determines that the domain name resolution request conforms to the domain name format of the private network; an allocation unit allocates a virtual address corresponding to the domain name format to the private network; a resolution unit resolves a target domain name of the private network from the virtual address in response to a resource access request from the client; and an access unit accesses network resources in the private network based on the original domain name of the private network corresponding to the target domain name, thereby achieving a technical effect of improving the efficiency of network connection and solving the technical problem of low efficiency of network connection.

[0219] Example 5

[0220] An embodiment of the present invention may provide a processor, which may include a computer terminal, which may be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the computer terminal may also be replaced by a terminal device such as a mobile terminal.

[0221] Optionally, in this embodiment, the computer terminal may be located in at least one network device among a plurality of network devices of a computer network.

[0222] In this embodiment, the above-mentioned computer terminal can execute the program code of the following steps in the private network access method of the application: obtaining a domain name resolution request from a client, wherein the client is an access end of the private network to be accessed; determining that the domain name resolution request conforms to the domain name format of the private network; allocating a virtual address corresponding to the domain name format to the private network; in response to a resource access request from the client, resolving the target domain name of the private network from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent the target address of the private network; based on the original domain name of the private network corresponding to the target domain name, accessing network resources in the private network, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network.

[0223] Optionally, Figure 14 1 is a block diagram of a computer terminal according to an embodiment of the present invention. Figure 14 As shown, the computer terminal A may include: one or more (only one is shown in the figure) processors 1402 , a memory 1404 , and a transmission device 1406 .

[0224] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the private network access method and apparatus in the embodiments of the present invention. The processor executes the software programs and modules stored in the memory to perform various functional applications and predictions, thereby implementing the private network access method described above. The memory can include high-speed random access memory (RAM) and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory can further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal A via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0225] The processor can call information and applications stored in the memory through a transmission device to perform the following steps: obtaining a domain name resolution request from a client, wherein the client is an access end of a private network to be accessed; determining that the domain name resolution request conforms to a domain name format of the private network; allocating a virtual address corresponding to the domain name format to the private network; in response to a resource access request from the client, resolving a target domain name of the private network from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent a target address of the private network; and accessing network resources in the private network based on an original domain name of the private network corresponding to the target domain name, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent an original address of the private network.

[0226] Optionally, the processor may further execute program code of the following steps: determining a domain name field of the original domain name and a resource field of the network resource; and establishing a domain name format based on the domain name field and the resource field.

[0227] Optionally, the above-mentioned processor can also execute the program code of the following steps: extracting the attribute field of the network resource from the resource field, wherein the attribute field is used to represent the name of the network resource and / or the type of the network resource; splicing the attribute field to the end of the domain name field to obtain the domain name format.

[0228] Optionally, the processor may also execute the following program code: detecting whether the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource; if it is detected that the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource, determining that the domain name resolution request conforms to the domain name format, wherein the name of the network resource and / or the type of the network resource is located at the end of the original domain name.

[0229] Optionally, the processor may also execute the program code of the following steps: determining the first network segment where the client is currently located; determining a second network segment different from the first network segment; and allocating a virtual address corresponding to the domain name format and located on the second network segment to the private network.

[0230] Optionally, the processor may also execute the program code of the following steps: in response to a resource access request being transmitted in accordance with the Hypertext Transfer Protocol, cleaning the resource access request, wherein the cleaned resource access request conforms to the original domain name format of the private network; based on the cleaned resource access request, resolving the original domain name corresponding to the target domain name from the virtual address.

[0231] Optionally, the processor may further execute program code of the following steps: parsing an identifier corresponding to the original domain name from the socket of the private network; and parsing the original domain name from the virtual address based on the identifier.

[0232] Optionally, the processor may further execute program codes of the following steps: accessing a private network based on a virtual extended local area network, and accessing network resources in the private network according to the original domain name.

[0233] Optionally, the processor may further execute program code for the following steps: obtaining a domain name resolution request from a business container of a client in a network proxy container, wherein the network proxy container and the business container share the same operating cycle, and the client accesses the private network through the business container; and resolving a target domain name from a virtual address in response to a resource access request from the business container of the client.

[0234] As an optional example, the processor can call the information and application stored in the memory through the transmission device to perform the following steps: obtain the original domain name of the private network, wherein the original domain name is used to represent the original address of the private network; encode the original domain name according to the domain name format of the private network to obtain the target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; send the target domain name to the client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the domain name resolution request is used to assign a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0235] As an optional example, the processor can call the information and application stored in the memory through the transmission device to perform the following steps: obtain the original domain name of the private network by calling the first interface, wherein the first interface includes a first parameter, the parameter value of the first parameter is the original domain name, and the original domain name is used to represent the original address of the private network; encode the original domain name according to the domain name format of the private network to obtain the target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; send the target domain name to the client by calling the second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the second interface includes a second parameter, the parameter value of the second parameter is the target domain name, the domain name resolution request is used to assign a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0236] In an embodiment of the present invention, a domain name format that conforms to a private network is determined based on a domain name resolution request of a client, a virtual address corresponding to the domain name format is determined based on the domain name format of the private network, a resource access request that conforms to the domain name format issued by the client is obtained, a target domain name of the private network is resolved from the virtual address based on the resource access request, and network resources in the private network can be accessed based on the original domain name of the private network corresponding to the target domain name, thereby achieving a technical effect of improving the efficiency of network connection and solving the technical problem of low efficiency of network connection.

[0237] It can be understood by those skilled in the art that Figure 14 The structure shown is for illustration only, and the computer terminal A may also be a smart phone (eg, tablet computer, handheld computer, mobile Internet device (MID), PAD and other terminal devices. Figure 14The structure of the computer terminal A is not limited. For example, the computer terminal A may also include Figure 14 More or fewer components (such as network interfaces, display devices, etc.) shown, or with Figure 14 Different configurations shown.

[0238] A person skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0239] Example 6

[0240] The embodiment of the present invention further provides a computer-readable storage medium. Optionally, in this embodiment, the computer-readable storage medium can be used to store the program code executed by the private network access method provided in the above embodiment 1.

[0241] Optionally, in this embodiment, the computer-readable storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0242] Optionally, in this embodiment, the above-mentioned computer-readable storage medium is configured to store program code for executing the following steps: obtaining a domain name resolution request from a client, wherein the client is an access end of a private network to be accessed; determining that the domain name resolution request conforms to the domain name format of the private network; allocating a virtual address corresponding to the domain name format to the private network; in response to a resource access request from the client, resolving a target domain name of the private network from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent the target address of the private network; accessing network resources in the private network based on the original domain name of the private network corresponding to the target domain name, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network.

[0243] Optionally, the computer-readable storage medium may further execute program code for the following steps: determining a domain name field of the original domain name and a resource field of the network resource; and establishing a domain name format based on the domain name field and the resource field.

[0244] Optionally, the above-mentioned computer-readable storage medium can also execute the program code of the following steps: extracting the attribute field of the network resource from the resource field, wherein the attribute field is used to represent the name of the network resource and / or the type of the network resource; splicing the attribute field to the end of the domain name field to obtain the domain name format.

[0245] Optionally, the computer-readable storage medium may also execute program code for the following steps: detecting whether the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource; if it is detected that the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource, determining that the domain name resolution request conforms to the domain name format, wherein the name of the network resource and / or the type of the network resource is located at the end of the original domain name.

[0246] Optionally, the computer-readable storage medium may also execute program code for the following steps: determining the first network segment where the client is currently located; determining a second network segment different from the first network segment; and allocating a virtual address to the private network that corresponds to the domain name format and is located on the second network segment.

[0247] Optionally, the computer-readable storage medium may also execute program code for the following steps: in response to a resource access request being transmitted in accordance with the Hypertext Transfer Protocol, cleaning the resource access request, wherein the cleaned resource access request conforms to the original domain name format of the private network; based on the cleaned resource access request, resolving the original domain name corresponding to the target domain name from the virtual address.

[0248] Optionally, the computer-readable storage medium may further execute program code for the following steps: resolving an identifier corresponding to the original domain name from the socket of the private network; and resolving the original domain name from the virtual address based on the identifier.

[0249] Optionally, the computer-readable storage medium may further execute program code for the following steps: accessing a private network based on a virtual extended local area network, and accessing network resources in the private network according to the original domain name.

[0250] Optionally, the computer-readable storage medium may further execute program code for the following steps: obtaining, in a network proxy container, a domain name resolution request from a client's business container, wherein the network proxy container and the business container share the same operating cycle, and the client accesses the private network through the business container; and resolving, in response to a resource access request from the client's business container, a target domain name from a virtual address.

[0251] As an optional example, a computer-readable storage medium is configured to store program code for performing the following steps: obtaining an original domain name of a private network, wherein the original domain name is used to represent the original address of the private network; encoding the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; sending the target domain name to a client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the domain name resolution request is used to assign a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0252] As an optional example, a computer-readable storage medium is configured to store program code for performing the following steps: obtaining the original domain name of the private network by calling a first interface, wherein the first interface includes a first parameter, the parameter value of the first parameter is the original domain name, and the original domain name is used to represent the original address of the private network; encoding the original domain name according to the domain name format of the private network to obtain the target domain name of the private network, wherein the target domain name is used to represent the target address of the private network; sending the target domain name to the client by calling a second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the second interface includes a second parameter, the parameter value of the second parameter is the target domain name, the domain name resolution request is used to assign a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

[0253] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0254] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0255] In the several embodiments provided by the present invention, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, and can be electrical or other forms.

[0256] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0257] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0258] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0259] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for accessing a private network, characterized in that: include: Obtaining a domain name resolution request from a client, wherein the client is an access terminal to a private network to be accessed; Determining that the domain name resolution request conforms to the domain name format of the private network; Allocating a virtual address corresponding to the domain name format to the private network; Responding to a resource access request from the client, parsing a target domain name of the private network from the virtual address, wherein the resource access request conforms to the domain name format and the target domain name is used to represent a target address of the private network; Based on the original domain name of the private network corresponding to the target domain name, network resources in the private network are accessed, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network.

2. The method according to claim 1, characterized in that The method further comprises: Determining a domain name field of the original domain name and a resource field of the network resource; The domain name format is established based on the domain name field and the resource field.

3. The method according to claim 2, characterized in that Establishing the domain name format based on the domain name field and the resource field includes: Extracting an attribute field of the network resource from the resource field, wherein the attribute field is used to represent the name of the network resource and / or the type of the network resource; The attribute field is spliced to the end of the domain name field to obtain the domain name format.

4. The method according to claim 1, wherein The method further comprises: detecting whether the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource; If it is detected that the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource, it is determined that the domain name resolution request conforms to the domain name format, wherein the name of the network resource and / or the type of the network resource are located at the end of the original domain name.

5. The method according to claim 1, wherein Allocating a virtual address corresponding to the domain name format to the private network includes: Determine the first network segment where the client is currently located; determining a second network segment different from the first network segment; The virtual address corresponding to the domain name format and located on the second network segment is allocated to the private network.

6. The method according to claim 1, characterized in that The method further comprises: In response to the resource access request being transmitted according to the hypertext transfer protocol, cleaning the resource access request, wherein the cleaned resource access request conforms to the original domain name format of the private network; Based on the cleaned resource access request, the original domain name corresponding to the target domain name is parsed from the virtual address.

7. The method according to claim 6, characterized in that Parsing the original domain name corresponding to the target domain name from the virtual address includes: Parsing an identifier corresponding to the original domain name from the socket of the private network; The original domain name is resolved from the virtual address based on the identifier.

8. The method according to claim 1, characterized in that Accessing the network resource in the private network based on the original domain name of the private network corresponding to the target domain name includes: The private network is accessed based on a virtual extended local area network, and the network resources in the private network are accessed according to the original domain name.

9. The method according to any one of claims 1 to 8, characterized in that Get the domain name resolution request from the client, including: Obtaining, in a network proxy container, the domain name resolution request from the service container of the client, wherein the network proxy container and the service container share the same operating cycle, and the client accesses the private network through the service container; Responding to a resource access request from the client, resolving the target domain name of the private network from the virtual address includes: responding to the resource access request from the service container of the client, resolving the target domain name from the virtual address.

10. A method for accessing a private network, characterized in that: include: Obtaining an original domain name of the private network, wherein the original domain name is used to represent an original address of the private network; Encoding the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent a target address of the private network; The target domain name is sent to the client, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, and the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

11. A method for accessing a private network, characterized in that: include: Obtaining the original domain name of the private network by calling a first interface, wherein the first interface includes a first parameter, a parameter value of the first parameter is the original domain name, and the original domain name is used to represent the original address of the private network; Encoding the original domain name according to the domain name format of the private network to obtain a target domain name of the private network, wherein the target domain name is used to represent a target address of the private network; The target domain name is sent to the client by calling a second interface, so that the client sends a domain name resolution request that conforms to the domain name format and a resource access request that conforms to the domain name format based on the target domain name, wherein the second interface includes a second parameter, the parameter value of the second parameter is the target domain name, the domain name resolution request is used to allocate a virtual address corresponding to the domain name format to the private network, the resource access request is used to resolve the target domain name of the private network from the virtual address, and the original domain name corresponding to the target domain name is used to access network resources in the private network.

12. A private network access system, characterized in that: include: Client, network proxy container and gateway, where The client is configured to send a domain name resolution request to the network proxy container, wherein the client is an access terminal to access the gateway; The network proxy container is configured to determine whether the domain name resolution request conforms to the domain name format of the gateway, and assign a virtual address corresponding to the domain name format to the gateway; in response to a resource access request from the client, resolve a target domain name of the gateway from the virtual address, wherein the resource access request conforms to the domain name format, and the target domain name is used to represent the target address of the private network; and access network resources in the gateway based on the original domain name of the gateway corresponding to the target domain name, wherein the domain name format is used to encode the original domain name into the target domain name, and the original domain name is used to represent the original address of the private network; The gateway is configured to return the network resource to the network proxy container.

13. The system according to claim 12, wherein: The network proxy container includes: A request interception component is used to detect whether the domain name resolution request includes the original domain name, and the name and / or type of the network resource; if it is detected that the domain name resolution request includes the original domain name, and the name of the network resource and / or the type of the network resource, determine that the domain name resolution request conforms to the domain name format, wherein the name of the network resource and / or the type of the network resource is located at the end of the original domain name in the domain name resolution request.

14. The system according to claim 12, wherein: The network proxy container includes: The transmission component is configured to determine a first network segment in which the client is currently located; determine a second network segment different from the first network segment; and assign the virtual address corresponding to the domain name format and located on the second network segment to the private network; a cleaning component, configured to cleanse the resource access request in response to the resource access request being transmitted according to the hypertext transfer protocol, wherein the cleaned resource access request conforms to the original domain name format of the private network; The transmission component is further configured to resolve the original domain name corresponding to the target domain name from the virtual address based on the cleaned resource access request.

Images